{"id":"CVE-2016-2315","url":"https://www.cyber-defence.io/tools/cve/CVE-2016-2315","generatedAt":"2026-11-05T05:35:28.293Z","title":"revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.","description":"revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.","published":"2016-04-08T14:59:01.000Z","lastModified":"2026-06-17T00:43:49.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-119"],"affected":["suse/linux enterprise debuginfo","suse/openstack cloud","opensuse/leap","opensuse/opensuse","suse/linux enterprise server","suse/linux enterprise software development kit","suse/suse linux enterprise server","git-scm/git"],"epss":{"score":0.17312,"percentile":0.97119,"date":"2026-11-04","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 17.3%, higher than 97% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html","tags":["Mailing List","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html","tags":["Mailing List","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html","tags":["Mailing List"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html","tags":["Mailing List","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html","tags":["Mailing List","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html","tags":["Mailing List","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html","tags":["Mailing List","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html","tags":["Mailing List","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html","tags":["Mailing List","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html","tags":["Mailing List","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://pastebin.com/UX2P2jjg","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0496.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.debian.org/security/2016/dsa-3521","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2016/03/15/5","tags":["Mailing List"],"source":"cve@mitre.org"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/84355","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://www.securitytracker.com/id/1035290","tags":["Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"http://www.ubuntu.com/usn/USN-2938-1","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","tags":["Patch","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/201605-01","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html","tags":["Mailing List","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html","tags":["Mailing List","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html","tags":["Mailing List","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html","tags":["Mailing List","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html","tags":["Mailing List","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html","tags":["Mailing List","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html","tags":["Mailing List","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html","tags":["Mailing List","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://pastebin.com/UX2P2jjg","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0496.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2016/dsa-3521","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2016/03/15/5","tags":["Mailing List"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/84355","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securitytracker.com/id/1035290","tags":["Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2938-1","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","tags":["Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201605-01","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-2315","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}